Subject: [mobile-ip] Re: issues in mipv6-ipsec: DHAAD

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 27 Sep 2002 18:38:28 -0700

DHAAD reply is already sent to CoA. so there is no change required there.

but we have a problem with MPS/MPA. unless the MPA is sent to the
home address, it cannot be IPsec protected. but if home address
is used we lose "bootstrapping from remote" feature.

I hate this. wish we hadnt decided on IPsec protection for MPS/MPA.
it has so many side effects.

Vijay

Jari Arkko wrote:
> 
> Since both DHAAD and prefix discovery use ICMP messages, the
> DHAAD response packets from the home agent to the mobile node look exactly
> like prefix discovery from the point of view of IPsec. Yet, the
> policies for DHAAD and prefix discovery are different (pass and protect,
> respectively).
> 
> Note that the anycast DHAAD request is not automatically
> protected, as the anycast address isn't in the SPD as
> we proposed it.
> 
> Some ideas on how to deal with this:
> 
> - Prefix discovery MUST use (an existing) home address
>   and DHAAD MUST use care-of address.
> 
>   The home agent MUST verify that it does not
>   respond to a prefix discovery request to an address
>   which is not a home address. This ensures that the
>   SPD prevents prefix information from leaking (since
>   it contains all home addresses and ICMP). Any problems
>   in making the prefix discovery use home addresses?
> 
>   DHAAD goes to care-of address, and is not protected.
> 
> - Protect both DHAAD responses and prefix discovery,
>   i.e., ICMP is protected to all addresses. Appears
>   to require IKE, as otherwise the SAs to all
>   possible addresses can't be established.
> 
> - ICMP type specific selectors are required.
> 
> - Something else, what?
> 
> Jari
>